A researcher showed that a booby-trapped text can knock out an Android phone's cellular service. Google's October update fixes it, but older phones may be left out.
A security researcher has shown that one specially built text message can crash the cellular service on some Android phones. The owner does not have to open it or tap anything. The flaw is called "SMS of Death," and in testing, it could trap a phone in a reboot loop.
The researcher, Mark Blaszczyk, told Google about the flaw in May. On October 29, he published his findings along with a working demonstration. He reproduced the attack on Google Pixel and Samsung Galaxy phones. The flaw is tracked as CVE-2026-58882.
It involves WAP Push messages. Android handles these in the background, and they do not show up in the normal text inbox. A malformed one can cause an error that brings down the part of the system that manages cellular connectivity.
A crash can cut off a call in progress, including a call to emergency services. If the carrier tries to deliver the same message again, the phone can crash again and again. In testing, about 20 bad messages were enough to leave a phone stuck in a reboot loop.
Getting out of that loop is not simple. A factory reset works. The other route uses a developer tool called Android Debug Bridge to clear the bad messages, and most people would not know how to do that.
This flaw crashes phones. It does not steal passwords or personal data. There is also no confirmed evidence so far of widespread attacks on Android users.
Brand does not decide the risk. The Android version and the security patch do. The researcher says Google's October 2026 security updates fix the problem on Android 14 through 17. He also says Android 12 and 13 phones have not received the fix, which leaves those without ongoing security support exposed. Google did not mention the flaw in its October security bulletin.
The steps in the box above cover it. In short, check your phone's security patch level in Settings and install any waiting update. The exact menu location varies by manufacturer.
It is not yet clear whether Google or phone makers will release a fix for Android 12 and 13. The material does not say. Owners of those phones may want to ask their phone maker directly, and plan for a replacement if no update is coming.
Check your Android security patch level and install the latest update, especially if your phone runs Android 12 or 13.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
